OSV.dev Analyzer Dependency Sources in NVIDIA SkillSpector: PyPI and npm Support

The OSV.dev analyzer in NVIDIA SkillSpector supports vulnerability scanning for two dependency ecosystems: Python packages distributed via PyPI and JavaScript packages distributed via npm.

The OSV.dev analyzer is a core component of the SkillSpector supply-chain security pipeline that queries the Open Source Vulnerabilities (OSV) database. According to the NVIDIA SkillSpector source code, the analyzer explicitly defines ecosystem identifiers for PyPI and npm to construct valid API requests against OSV.dev.

Supported Dependency Ecosystems

The analyzer recognizes two distinct software ecosystems. These identifiers are hardcoded as string constants in the OSV client module and must be passed to batch query functions to specify which package registry to target.

Python Packages (PyPI)

PyPI (Python Package Index) is the primary repository for Python software. The analyzer references this ecosystem using the constant ECOSYSTEM_PYPI, which evaluates to the string "PyPI".

When scanning Python dependencies, the analyzer constructs queries using this identifier to retrieve vulnerability data specific to Python packages. The constant is defined in src/skillspector/nodes/analyzers/osv_client.py alongside the npm identifier.

JavaScript Packages (npm)

npm (Node Package Manager) is the default package manager for the JavaScript runtime environment Node.js. The analyzer uses the constant ECOSYSTEM_NPM, defined as "npm", to query JavaScript package vulnerabilities.

This dual-ecosystem support allows SkillSpector to analyze both backend Python dependencies and frontend JavaScript dependencies within a single codebase.

Querying the OSV.dev API

The query_batch function in osv_client.py accepts a list of package name-version tuples and an ecosystem identifier. The function returns a list of vulnerability results for each package queried.

Querying PyPI Packages

You can look up vulnerabilities for Python packages by importing the ECOSYSTEM_PYPI constant and calling query_batch:

from skillspector.nodes.analyzers.osv_client import ECOSYSTEM_PYPI, query_batch

# Look up vulnerabilities for the `requests` package (any version)

results = query_batch([("requests", None)], ECOSYSTEM_PYPI)

for pkg_idx, vulns in enumerate(results):
    print(f"Package {pkg_idx} vulnerabilities:")
    for vuln in vulns:
        print(f"- {vuln.vuln_id}: {vuln.summary} [{vuln.severity}]")

Querying npm Packages with Specific Versions

For JavaScript dependencies, use ECOSYSTEM_NPM and optionally specify a version string to retrieve precise vulnerability matches:

from skillspector.nodes.analyzers.osv_client import ECOSYSTEM_NPM, query_batch

# Look up vulnerabilities for lodash version 4.17.20

results = query_batch([("lodash", "4.17.20")], ECOSYSTEM_NPM)

for vuln in results[0]:
    print(f"{vuln.vuln_id} – {vuln.severity}")

Implementation Details

The ecosystem constants are declared at lines 41–44 in src/skillspector/nodes/analyzers/osv_client.py. These constants ensure that all API requests sent to OSV.dev use the correct ecosystem taxonomy required by the service.

Before executing queries, the analyzer can verify OSV.dev API availability using the is_available() function:

from skillspector.nodes.analyzers.osv_client import is_available

if is_available():
    print("OSV.dev API reachable")
else:
    print("OSV.dev API not reachable – fallback to static data may be required")

Unit tests for both ecosystems are located in tests/unit/test_osv_client.py, which validates the client's ability to parse responses for both PyPI and npm vulnerability formats.

Integration with Supply Chain Analysis

The OSV.dev analyzer integrates into the broader supply-chain security pipeline through src/skillspector/nodes/analyzers/static_patterns_supply_chain.py. This module imports the ecosystem constants (ECOSYSTEM_PYPI and ECOSYSTEM_NPM) from osv_client.py and orchestrates vulnerability scanning across dependency manifests found in the target repository.

When a batch query is performed, the caller must specify one of the two supported ecosystems; otherwise the OSV.dev service will reject the request. The analyzer validates ecosystem selection before submitting requests to prevent API errors.

Summary

• NVIDIA SkillSpector's OSV.dev analyzer supports vulnerability scanning for PyPI (Python) and npm (JavaScript) packages.
• Ecosystem identifiers ECOSYSTEM_PYPI ("PyPI") and ECOSYSTEM_NPM ("npm") are defined in src/skillspector/nodes/analyzers/osv_client.py.
• Use the query_batch function to submit package names and versions to the OSV.dev API, specifying the appropriate ecosystem constant.
• The is_available function checks OSV.dev API reachability before querying.
• Integration occurs through static_patterns_supply_chain.py, which orchestrates multi-ecosystem dependency analysis.

Frequently Asked Questions

Does the OSV.dev analyzer support Maven, NuGet, or other package ecosystems?

No. According to the source code in osv_client.py, the SkillSpector implementation currently hardcodes support for only two ecosystems: PyPI and npm. The constants ECOSYSTEM_PYPI and ECOSYSTEM_NPM are the only ecosystem identifiers exported by the module. Attempting to query other ecosystems would result in the OSV.dev service rejecting the request.

How do I check if the OSV.dev API is reachable before querying?

Import the is_available function from skillspector.nodes.analyzers.osv_client and call it to verify network connectivity to the OSV.dev API. This function returns a boolean indicating whether the service is reachable, allowing your analysis pipeline to fall back to static vulnerability data if the API is unavailable.

Where are the ecosystem constants defined in the SkillSpector repository?

The ecosystem constants are defined at lines 41–44 in src/skillspector/nodes/analyzers/osv_client.py. The file declares ECOSYSTEM_PYPI = "PyPI" and ECOSYSTEM_NPM = "npm" as module-level constants. These identifiers match the ecosystem taxonomy required by the OSV.dev API specification.

Can I query multiple packages in a single batch request?

Yes. The query_batch function accepts a list of tuples containing package names and optional version strings. You can query multiple packages simultaneously, but all packages in a single batch must belong to the same ecosystem. You must make separate query_batch calls for PyPI packages and npm packages, passing the appropriate ecosystem constant for each invocation.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}